DDoS Detection Algorithm Based on Preprocessing Network Traffic Predicted Method and Chaos Theory

• Published in: IEEE communications letters Vol. 17; no. 5; pp. 1052 - 1054
• Main Authors: Chen, Yonghong, Ma, Xinlei, Wu, Xinya
• Format: Journal Article
• Language: English
• Published: New York, NY IEEE 01.05.2013; Institute of Electrical and Electronics Engineers; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Algorithms; anomaly detection; Applied sciences; AR model; Artificial intelligence; Chaos theory; chaotic; Chaotic communication; Computer crime; Computer science; control theory; systems; Connectionism. Neural networks; Detection algorithms; Distributed denial-of-service (DDoS); Exact sciences and technology; Interconnected networks; Internet; Mathematical models; Networks; Networks and services in france and abroad; Neural networks; Operation, maintenance, reliability of teleprocessing networks; Predictive models; Preprocessing; Systems, networks and services of telecommunications; Telecommunications; Telecommunications and information theory; Teleprocessing networks. Isdn; Teletraffic; Time series analysis; Traffic engineering; Traffic flow; Chaos; AR model; Averaging method; Teletraffic; Autoregressive model; anomaly detection; Neural network; Distributed system; Algorithm; Linear model; Learning; Traffic management; chaotic; Denial of service; Internet; Traffic congestion; Telecommunication security; Distributed denial-of-service (DDoS)
• ISSN: 1089-7798; 1558-2558
• DOI: 10.1109/LCOMM.2013.031913.130066

Distributed denial-of-service (DDoS) flooding attacks still pose great threats to the Internet even though various approaches and systems have been proposed. In this paper, we firstly pre-process network traffic by cumulatively averaging it with a time range, and using the simple linear AR model, and then generate the prediction of network traffic. Secondly, assuming the prediction error behaves eechaoticallyee, we use chaos theory to analyze it and then propose a novel network anomaly detection algorithm (NADA) to detect the abnormal traffic. With this abnormal traffic, we lastly train a neural network to detect DDoS attacks. Our preliminary experiments and analyses indicate that our proposed DDoS detection algorithm can accurately and effectively detect DDoS attacks.